Step 1 Install Docker and Compose

On the new Collabora server

Run the following on the new Collabora server. These commands use the Ubuntu packages for the reference Ubuntu 24.04 LTS installation. If your organisation already manages Docker centrally, use its approved installation method and ensure Docker Compose v2 is available.

sudo apt update
sudo apt install -y docker.io docker-compose-v2
sudo systemctl enable --now docker
sudo docker compose version

The last command should report a Docker Compose version. If the package is unavailable through your configured repositories, have your Linux administrator resolve the repository configuration before continuing.

Back to contents

Step 2 Create the installation folder

On the Collabora server

sudo mkdir -p /opt/collabora/certs
sudo chmod 755 /opt/collabora
cd /opt/collabora

Keep deployment configuration in this folder. Run the remaining Compose commands from /opt/collabora so that they use the intended configuration.

Back to contents

Step 3 Copy the SciSure deployment files

On the Collabora server

Copy the two supplied production files into the installation folder. Replace /path/to with the folder where you downloaded them.

sudo cp /path/to/docker-compose.yml /opt/collabora/docker-compose.yml
sudo install -m 600 /path/to/.env.example /opt/collabora/.env

Keep the supplied Compose file unchanged for the standard configuration. Follow the package instructions for registry authentication and licence activation if these are required. Keep credentials in your approved secrets process.

Back to contents

Step 4 Configure your environment

On the Collabora server

sudo nano /opt/collabora/.env

The reference package uses the settings below. Keep the production image and version specified by SciSure. Replace the example hostnames and administrator credentials with your own values.

Scroll horizontally to see all table columns.

The WOPI allow-list format must match the production package. Permit only the agreed ELN hosts. If users access the ELN through several addresses, ask SciSure to validate each host or alias before adding it.

If your setup differs: Review a different host port, a reverse proxy or additional ELN addresses before finalising the configuration.

Back to contents

Step 5 Add the TLS certificate

On the Collabora server and systems that must trust its certificate

Place these PEM files in /opt/collabora/certs. Use the exact filenames expected by the deployment package.

Scroll horizontally to see all table columns.

Protect the certificate and verify trust

Set ownership and permissions so that the Collabora container process can read the certificate files. Restrict the private key to root and the required runtime identity. The appropriate owner or group depends on the production image. Use the identity and permissions supplied with the package; do not make key.pem readable by all local users.

A common approach is read access through a dedicated group with mode 640 for the private key, but only after assigning the correct runtime group. The certificate directory must also allow that identity to traverse it. If the service cannot read a file, correct ownership or access rather than granting broad permissions.

The certificate must match the hostname, be within its validity period and present a complete trusted chain. If you use an internal certificate authority, install its trust chain on the user computers and the ELN server. Collabora must separately trust the certificate used by the ELN server.

If your certificate is supplied as a PFX or P12 file, use the conversion instructions under Alternative configurations. Do not send the private key or certificate-export password to support in an ordinary message.

If needed: See PFX/P12 conversion or internal CA trust for the ELN. If a proxy handles HTTPS, use the reverse-proxy configuration. Return here to check certificate access and trust.

Back to contents

Step 6 Configure the firewall

On the Collabora host and the relevant network firewalls

Allow the browser, ELN and Collabora connections listed in Required connections. For a host that uses UFW, the reference rule is:

sudo ufw allow 443/tcp

Apply your organisation’s source restrictions at the appropriate network firewall as well. Docker-published ports can bypass ordinary UFW filtering, so validate the actual exposure and use the Docker-aware controls required by your firewall design. Confirm that no other service already binds the chosen host port.

For a reverse proxy: Apply the proxy-specific exposure rules before starting the service.

Back to contents

Step 7 Start Collabora

On the Collabora server

cd /opt/collabora
sudo docker compose config --quiet
sudo docker compose pull
sudo docker compose up -d
sudo docker compose ps
sudo docker compose logs -f

Resolve configuration or image access errors before proceeding. Confirm that the service is running and the logs show that it is ready to accept connections. The reference container listens internally on port 9980, even when users connect to host port 443.

Press Ctrl+C to stop following the logs. This does not stop Collabora. The supplied service configuration should include the agreed restart policy so that it recovers after a host reboot.

Back to contents

Step 8 Check browser and server connectivity

From a user computer, the ELN web server and the running Collabora container

Open the discovery address below from a normal user computer. Substitute your Collabora hostname. It should return XML without a certificate warning.

https://collabora.example.com/hosting/discovery

Also check that the ELN web server can reach the discovery endpoint. Confirm that the running Collabora container can resolve and reach the ELN address and trust its certificate; a successful connection from the host alone does not confirm container connectivity. Resolve DNS, TLS or network failures before enabling the integration.

Back to contents

Step 9 Connect Collabora to eLabNext

With SciSure Support and your IT administrator

Email your Collabora base URL, for example https://collabora.example.com, to support@elabnext.com together with your organisation, ELN URL and technical contact. Share administrator credentials only through the agreed secure channel if they are needed.

SciSure will coordinate the ELN configuration and the switch to the Collabora editing service. Confirm that the Q4 release, add-on version and licence requirements are satisfied first. Do not retire Office Online Server until the replacement workflow has been validated and the change is agreed.

Optional administration console

Where the production package enables the Collabora administration console, open the following address from an authorised administrator computer and sign in with the configured credentials. Restrict console access to administrators through the approved network or proxy controls.

https://collabora.example.com/browser/dist/admin/admin.html

Back to contents

Step 10 Validate the complete workflow

In eLabNext, using normal user accounts

Use representative test files and normal user accounts. A working discovery page confirms connectivity, but the following checks confirm that editing and saving work together.

1. Open a Word document, an Excel workbook and a PowerPoint presentation from the ELN. Check that the editor loads without errors.
2. Make a recognisable test change, save it, close the editor and reopen the file from the ELN. Verify that the change has been retained.
3. Download the updated file and check it in the appropriate desktop application. Include complex formatting and any advanced features your team relies on.
4. Check the Office previews and history functions used by your team. Confirm that authorised users have the expected access.
5. Test concurrent editing if your team uses it and confirm that a normal editing session remains connected through the proxy and firewall.
6. Record the outcome with SciSure and agree the production switch. Tell users when the interface changes and how to get help.

Complete the transition

Keep the old service available only as required by the agreed change and recovery plan. After successful validation, agree when to retire the Office Online Server connection and when its server can be decommissioned. Confirm that it has no other dependencies before removing it.

Share the test results

Email support@elabnext.com with your organisation, ELN URL, Collabora URL, approved image/version, deployment status, technical contact and preferred transition window. Include the results of the open, save and reopen tests. If a check fails, include its timestamp and time zone, a description of the symptom and relevant redacted logs.

Back to contents